ID |
CVE-2014-8886
|
Summary |
AVM FRITZ!OS before 6.30 extracts the contents of firmware updates before verifying their cryptographic signature, which allows remote attackers to create symlinks or overwrite critical files, and consequently execute arbitrary code, via a crafted firmware image. |
References |
|
Vulnerable Configurations |
|
CVSS |
Base: | 9.3 (as of 09-10-2018 - 19:54) |
Impact: | |
Exploitability: | |
|
CWE |
CWE-310 |
CAPEC |
|
Access |
Vector | Complexity | Authentication |
NETWORK |
MEDIUM |
NONE |
|
Impact |
Confidentiality | Integrity | Availability |
COMPLETE |
COMPLETE |
COMPLETE |
|
cvss-vector
via4
|
AV:N/AC:M/Au:N/C:C/I:C/A:C
|
refmap
via4
|
bugtraq | 20160107 [RT-SA-2014-014] AVM FRITZ!Box: Arbitrary Code Execution Through Manipulated Firmware Images | confirm | https://avm.de/service/sicherheitsinfos-zu-updates/ | fulldisc | 20160107 [RT-SA-2014-014] AVM FRITZ!Box: Arbitrary Code Execution Through Manipulated Firmware Images | misc | |
|
Last major update |
09-10-2018 - 19:54 |
Published |
08-01-2016 - 20:59 |
Last modified |
09-10-2018 - 19:54 |